Token Versioning With Namespaces to Reduce Reissue Conflicts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing token systems face interoperability issues and conflicts due to multiple tokens being mapped to a single instance of sensitive data, such as primary account numbers, leading to potential breaches and inefficiencies.
Innovation Solution
A token versioning and reissue system that includes a tokenization service generating and managing tokens with namespaces, allowing for automated refresh and replacement of tokens in response to events like breaches or parameter changes, ensuring seamless transition and data isolation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple tokens are mapped to a single primary account number, then token versatility and reuse are improved, but interoperability conflicts and system reliability deteriorate
Solution Approach 1:
The patent segments the token space by introducing namespaces that partition tokens into distinct versions (e.g., namespace 'v1' for legacy tokens, namespace 'v2' for new tokens). This segmentation allows multiple token versions to coexist without conflict, as each namespace operates independently with its own token generation rules and mappings to primary account numbers.
Solution Approach 2:
The patent introduces a token version identifier as an intermediary element that mediates between old and new token systems. This version identifier allows the system to distinguish between different token generations, enabling seamless transitions and interoperability while maintaining the ability to reuse tokens within their designated versions.
2Reliability
If token parameters are changed to improve security or functionality, then token reliability is improved, but system adaptability and continuity deteriorate
Solution Approach 1:
The patent implements dynamic token parameter management where token characteristics (length, format, datatype) are not fixed but can be adjusted by updating namespace configurations. The system maintains operational flexibility by allowing parameter changes within namespaces while preserving backward compatibility through versioning, enabling security improvements without breaking existing integrations.
Solution Approach 2:
The patent prepares for parameter changes by establishing a namespace versioning framework in advance. This preliminary structure allows the system to accommodate future parameter modifications without disruption, as new parameter sets can be introduced in new namespaces while old namespaces continue to function with their original parameters.
3Reliability
If tokens are refreshed and replaced in response to breaches, then system security is improved, but loss of time and operational continuity deteriorate
Solution Approach 1:
The patent prepares for security incidents by maintaining multiple namespace versions in advance. When a breach is detected, the system can immediately switch to a pre-configured namespace with refreshed tokens, rather than generating new tokens from scratch. This preliminary preparation significantly reduces the time required for token replacement while maintaining security.
Solution Approach 2:
The namespace version identifier acts as an intermediary that enables rapid token refresh during security incidents. By switching namespace versions rather than individually regenerating tokens, the system minimizes disruption to operations while ensuring compromised tokens are replaced with secure alternatives.
Data Source
AI summary
A method may include a tokenization service: receiving, from a token management system, a namespace and a plurality of token parameters for the namespace; receiving a one-time load of a plurality of primary account numbers from the token management system; generating a token corresponding to each of the plurality of primary account numbers using the token parameters; storing a mapping of the plurality of tokens to the primary account numbers in the namespace; providing the plurality of tokens to the token management system; receiving, in response to a token refresh event, a new namespace and new token parameters from the token management system; generating a new token corresponding to each of the primary account numbers using the new token parameters; storing a mapping of the plurality of new tokens to the primary account numbers; and providing the plurality of new tokens to the token management system.